fix: remove Immutable flag before writing efi vars

efivar/Cargo.toml

@@ -27,6 +27,7 @@ lazy_static = "1.4.0"
 ntapi = "0.4.1"
 winapi = { version = "0.3.9", features = ["errhandlingapi"] }
 thiserror = "1.0.49"
+rustix = { version = "0.38.30", features = ["fs"] }
 
 [features]
 store = ["base64", "serde", "serde_derive", "toml"]

efivar/src/sys/linux/efivarfs.rs

@@ -1,7 +1,7 @@
 //! efivarfs is the new interface to access EFI variables
 
 use std::fs;
-use std::fs::{File, OpenOptions};
+use std::fs::File;
 use std::io::prelude::*;
 use std::str::FromStr;
 
@@ -95,8 +95,32 @@ impl VarWriter for SystemManager {
         // Filename to the matching efivarfs file for this variable
         let filename = format!("{}/{}", EFIVARFS_ROOT, var);
 
+        // Open file read only to get FD for flags operations.
+        let f = File::open(&filename).map_err(|error| Error::for_variable(error, var))?;
+
+        // Read original flags.
+        let orig_flags = rustix::fs::ioctl_getflags(&f)
+            .map_err(|error| Error::for_variable(error.into(), var))?;
+
+        // If Immutable flag is present, remove it.
+        let immut_flag_removed = if orig_flags.contains(rustix::fs::IFlags::IMMUTABLE) {
+            // IFlags doesn't implement Clone, so cycle through bits.
+            let mut flags = rustix::fs::IFlags::from_bits(orig_flags.bits()).unwrap();
+
+            flags.remove(rustix::fs::IFlags::IMMUTABLE);
+            rustix::fs::ioctl_setflags(&f, flags)
+                .map_err(|error| Error::for_variable(error.into(), var))?;
+
+            true
+        } else {
+            false
+        };
+
+        // Close file before re-opening for write.
+        drop(f);
+
         // Open file.
-        let mut f = OpenOptions::new()
+        let mut f = File::options()
             .write(true)
             .truncate(true)
             .create(true)
@@ -107,6 +131,12 @@ impl VarWriter for SystemManager {
         f.write(&buf)
             .map_err(|error| Error::for_variable(error, var))?;
 
+        if immut_flag_removed {
+            // Add back the Immutable flag.
+            rustix::fs::ioctl_setflags(&f, orig_flags)
+                .map_err(|error| Error::for_variable(error.into(), var))?;
+        }
+
         Ok(())
     }